Most of this cluster's guides describe a version of the same EU baseline: GDPR's legitimate interest basis makes B2B cold email workable without prior consent. Germany is the exception worth planning around separately, and getting it wrong here carries a different kind of risk than a straightforward GDPR fine.
Germany layers a domestic unfair competition law on top of GDPR, and that law — not the general EU legitimate-interest framework — governs whether a commercial email is allowed in the first place. The result: a fully GDPR-compliant contact database does not, on its own, give you permission to cold email German contacts.
Germany's Gesetz gegen den unlauteren Wettbewerb (UWG — the Act Against Unfair Competition), Section 7, treats unsolicited commercial email as an unreasonable nuisance unless the recipient gave prior express consent. This provision functions as specialized law specifically for electronic communications, and it operates independently of — not subordinate to — GDPR's legitimate interest allowance.
The core distinction: GDPR's legitimate interest basis governs whether processing personal data is lawful. UWG §7 separately governs whether sending the unsolicited commercial message itself is lawful, under German competition law. You can satisfy the first and still violate the second.
Unlike the UK's corporate subscriber exemption or the general EU legitimate-interest approach covered in our GDPR guide, UWG §7 applies identically to business and consumer recipients for the email channel. There's no B2B carve-out. A cold email to a well-matched B2B contact in Germany needs the same prior express consent as a consumer marketing email would.
Germany's Federal Supreme Court (Bundesgerichtshof, BGH) has ruled that a single opt-in — one checkbox click, no confirmation step — isn't sufficient proof of valid consent. The court's standard requires double opt-in: an initial signup followed by a confirmation step (typically a confirmation email the recipient has to click through), with the confirmation communication itself staying neutral rather than promotional. This is a materially higher evidentiary bar than what CASL, CAN-SPAM, or the general EU legitimate-interest approach requires.
German courts have carved out more room for phone outreach: a "presumed consent" standard can apply to B2B phone calls when concrete, objective indicators, real signals tied to that specific business rather than general industry relevance, suggest the prospect would welcome contact. Importantly, the BGH's rulings are clear that this presumed-consent allowance for calls does not extend to email.
The practical sequencing this creates: many senders targeting German B2B contacts start with a phone call or a LinkedIn connection, use that first touch to get an actual expressed interest or explicit permission to follow up by email, document it, and only then move to email — rather than opening with a cold email the way they might into the US, UK, or most of the rest of the EU.
German enforcement of UWG violations doesn't only run through a data protection authority issuing a formal fine. Competitors and consumer-protection associations can issue an Abmahnung — a cease-and-desist warning letter — directly, and responding to one typically means paying the sender's legal costs even before any court involvement. This creates a faster, more frequent enforcement channel than GDPR's regulatory fine process, on top of whatever GDPR exposure exists if personal data handling was also mishandled.
For B2B outreach into Germany: treat email as requiring documented prior express consent with a double opt-in trail, use phone or LinkedIn as the genuine first touch where you don't already have that consent, and keep a clear record of how and when consent was obtained for every German contact on an email list. See our guide to implied vs express consent for how Germany's requirement compares to the implied-consent models used elsewhere in this cluster.
No. Germany's UWG §7 operates independently of GDPR's legitimate interest basis and requires prior express consent for commercial email regardless of GDPR compliance. A GDPR-lawful database does not by itself authorize German cold email.
Double opt-in means a signup step followed by a confirmation step, typically a confirmation email the recipient clicks through. Germany's Federal Supreme Court ruled single opt-in insufficient to prove valid consent, making double opt-in the practical evidentiary standard.
No. UWG §7 applies identically to business and consumer email recipients — there's no corporate-subscriber-style carve-out for the email channel, unlike the UK's PECR rules.
An Abmahnung is a cease-and-desist warning letter that competitors or consumer-protection associations can issue directly for UWG violations, typically requiring the recipient to cover the sender's legal costs even without court involvement — a faster, more frequent enforcement path than a formal regulatory fine.
Related guides
Written by
Scott Holmes
AI systems consultant based in Barrie, Ontario. Founder of Pinnacle Tech Projects. Has advised B2B senders on adapting outreach sequences for the German market's consent requirements.
Answer four quick questions and get a tool recommendation for your setup.